Commit graph

21 commits

Author SHA1 Message Date
Roan Kattouw
75b865cf87 In ResourceLoaderContext, normalize invalid skin names to $wgDefaultSkin . This should help a lot with the pollution of the module_deps table, which is currently littered with invalid skin names from people trying to hack the site. I found 3,897 (!!) distinct values for md_skin
Sample from the query result:

| md_module                   | md_skin                          |
|-----------------------------|----------------------------------|
| ext.vector.collapsibleNav   | vector'                          |
| ext.vector.collapsibleNav   | vector' and 1=1--                |
| ext.vector.collapsibleNav   | vector' and 1=2--                |
| ext.vector.collapsibleNav   | vector')waitfor delay'0:0:20'--  |
| ext.vector.collapsibleNav   | vector',0)waitfor delay'0:0:20'- |
| ext.vector.collapsibleNav   | vector',0,0)waitfor delay'0:0:20 |
| ext.vector.collapsibleNav   | vector',0,0,0)waitfor delay'0:0: |
| ext.vector.collapsibleNav   | vector'waitfor delay'0:0:20'--   |
| ext.vector.collapsibleNav   | vector../../../../../../../../.. |
[...]
| ext.vector.sectionEditLinks | vector<script src=               |
| ext.vector.sectionEditLinks | vector?.tri.co.id/               |
| ext.vector.sectionEditLinks | vector??id=jCustomerWAPProv      |
| ext.vector.sectionEditLinks | vector??id=wap.mauj.com....      |
| ext.vector.sectionEditLinks | vector?id=202.87.41.147....      |
| ext.vector.sectionEditLinks | vector?java                      |
| ext.vector.sectionEditLinks | vector?m.vuclip.com/             |
| ext.vector.sectionEditLinks | vector?toyota.co.id              |
| ext.vector.sectionEditLinks | vectorGET                        |
| ext.vector.sectionEditLinks | vector]]>>                       |
| ext.vector.sectionEditLinks | vector`ping -c 20 127.0.0.1`     |
| ext.vector.sectionEditLinks | vector|echo 9e7f7fd5750593ab cef |
| ext.vector.sectionEditLinks | vector|ping -c 20 127.0.0.1||x   |
2012-02-27 22:41:20 +00:00
Sam Reed
f8a0e34ca1 Documentation
Trim trailing whitespace

Make returns return values where appropriate (ie other paths in the same method do)
2011-10-14 08:06:54 +00:00
Roan Kattouw
7ef9760879 Accept ResourceLoader URLs containing '!' in '.' for backwards compatibility with a hack that existed in MediaWiki at some point (was in trunk and 1.17wmf1 but never in any release). This is needed because Squid-cached HTML at Wikimedia still contains such URLs. 2011-09-20 09:13:41 +00:00
Roan Kattouw
bcf236eddb Document the fact that some ResourceLoaderContext methods may return null 2011-09-13 20:15:00 +00:00
Roan Kattouw
418be34ddf Remove type hint that broke r95975 2011-09-01 13:07:27 +00:00
Roan Kattouw
84361c0962 Add ResourceLoaderContext::newDummyContext() function 2011-09-01 13:02:20 +00:00
Robin Pepermans
7c624542f0 (bug 6100; follow-up to r91315) Being bold and removing $wgBetterDirectionality (and dependent wfUILang) in core, as most or all work is finished.
Also:
* Introduce classes mw-float-end, mw-float-start so we don't have to use inline css depending on wfUILang()/$wgLang (see HistoryPage and SpecialFileDuplicateSearch)
* Add direction mark to protection log
* Remove specialpageattributes as it is obsoleted by this commit (also fixes bug 28572)
* Add two direction marks in wfSpecialList, which makes ltr links on rtl wiki (and vice versa) display nicely as well (only on those special pages however)
* Revert r91340 partially: use mw-content-ltr/rtl class anyway in shared.css. Both ways have their [dis]advantages...
* Set the direction of input fields by default to the content language direction (except buttons etc.) in shared.css
2011-07-06 02:26:06 +00:00
Robin Pepermans
932c44fd3e (part of bug 6100) Set the directionality based on user language instead of content language (as in r81622, but only when $wgBetterDirectionality is enabled) 2011-06-17 11:32:42 +00:00
Roan Kattouw
8dab43f703 (bug 28840) URLs with dots break because of IE6 security check
* Replace the overly paranoid regex with a function that simulates IE6's behavior
* Remove the UA check in isPathInfoBad(), was causing more problems than it was worth
* Revert r87711, going back to using dots for dots in ResourceLoader URLs, instead of exclamation marks
* Append &* to ResourceLoader URLs. * is an illegal character in extensions, and putting it at the end of the URL ensures that both IE6 and our detection function will deem the URL to have no extension (unless something like .html? appears in the query string, but in that case we're screwed no matter what)
2011-05-26 09:49:45 +00:00
Sam Reed
16c194d0ae Fixup/add documentation
Remove trailing whitespace
2011-05-21 17:45:20 +00:00
Roan Kattouw
a5de04f24a Fix bug in r87497, reported in CR: &modules=foo,bar,baz would look for '.foo', '.ar' and '.az' . Now handling prefixless modules correctly 2011-05-14 13:34:03 +00:00
Roan Kattouw
950cf2cb86 (bug 28840) Commit patch by bawolff that encodes dots in ResourceLoader module names as exclamation marks in the generated URLs, so as to avoid triggering the recently added IE security measure and causing a blank 403 response. This broke RL in various ways for IE users.
This is by no means intended to be permanent, but it's the best way to unbreak RL for IE users while we work out how to fix this properly.
2011-05-09 13:10:06 +00:00
Roan Kattouw
7fee86c38e Per bug 28738 comment 4, pack ResourceLoader URLs by encoding foo.bar|foo.baz|bar.baz|bar.quux as foo.bar,baz|bar.baz,quux
* Expand these URLs in ResourceLoaderContext
* Build and emit these URLs in OutputPage::makeResourceLoaderLink() and in mw.loader
* Throw an exception in ResourceLoader::register() for module names that contain pipe characters or commas. Commas need to be forbidden for this packing feature to work. Pipes were already forbidden but weren't checked for
2011-05-05 13:46:47 +00:00
Roan Kattouw
4d196860f7 Fix logic error in r73204 (!) causing ResourceLoaderContext::getHash() to always return null 2011-02-19 16:48:05 +00:00
Tim Starling
0f821f0dcb Use the content language to set the skin direction, instead of the user language. This makes the content readable and the UI messed up, instead of vice versa.
It's not ideal, but at least it's no worse than it was in 1.16. It's preferable because the content area is more likely to have bidirectional text than the UI area. The UI is split up into short strings, generally in a consistent language, so there is less chance of the UBA moving fragments of text around. 

Ideally, the direction of each div would be set according to the language of the text it contains.
2011-02-07 12:39:10 +00:00
Sam Reed
50b04942e4 Remove some unused variables and globals 2010-11-28 16:13:13 +00:00
Tim Starling
ec2acb239b * In ResourceLoaderContext, lazy-load $this->direction and $this->language, to avoid loading the whole English localisation for load.php requests which never call getHash().
* Interpreted some Trevor-speak in the doc comment of ResourceLoader::preloadModuleInfo().
* Made setMsgBlobMtime() (called from preloadModuleInfo()) actually work, by making getMsgBlobMtime() use the cached blob times if they are available.
2010-11-19 06:52:38 +00:00
Tim Starling
06b2b1bd66 Resource loader minor changes. Fix for r73668 etc.
* Break long lines.
* Convert long or unnecessary ternary operator usages to if/else.
* Fixed excessively clever assignment expressions.
* Rename $cache to $cacheEntry.
* Removed unnecessary web invocation guards. Their perlish form was making me uncomfortable. BTW, unlike in Perl, die() is not a function, it's a special case in the PHP grammar which very roughly simulates the Perl syntax:

die "x"; // works
0 || die("x"); // works
0 || (die); // works
0 || (die "x"); // fail!
2010-11-03 07:58:03 +00:00
Roan Kattouw
3517d951ba Some comment fixes: be consistent between # and //, fix grammar, remove information about internals from Doxygen comment (those are about what the function does, not how). Also make $modules argument to makeModuleResponse() default to array() instead of null 2010-10-20 14:58:35 +00:00
Antoine Musso
9adfb4f0a9 documentation, a couple notes about code and some whitespaces adjustements to make code easier to read. 2010-10-19 20:45:02 +00:00
Trevor Parscal
ef6baa91de Moved ResourceLoader classes to their own folder, preparing to also split ResourceLoaderModule.php into multiple files (it's getting a bit long now) 2010-10-19 18:21:38 +00:00
Renamed from includes/ResourceLoaderContext.php (Browse further)